Rasman service init error

Rasman_service_init_error_1_Rule (Rule)

Knowledge Base article:

Management Pack

Summary
The Remote Access Connection Manager service failed to start due to initialization failure.

Causes
The most common reasons for initialization failure are: The Remote Access Connection Manager service failed to start the WAN Mini Port (IP) device driver (NDISWAN). The most common reasons for this error are: The WAN Mini Port (IP) device driver (NDISWAN) failed to initialize. The Remote Access Connection Manager service does not have sufficient permissions to open the driver. The Remote Access Connection Manager service failed to create the security object. The most common reason for this error is that not enough memory is available on the server. The Remote Access Connection Manager service failed to retrieve information for this media device. The most common reasons for this error are: Media information for this device could not be retrieved from the registry. Rastapi.dll failed to load. The Remote Access Connection Manager service could not start because it failed to register with the Local Security Authority (LSA). The most common reasons for this error are: The Remote Access Connection Manager service does not have required permissions to register with the LSA. The LSA does not recognize the authentication package with which the Remote Access Connection Manager service tried to register. The Remote Access Connection Manager service failed because it encountered an error during RPC initialization. The most common reasons for this error are: The service could not load the necessary DLLs. The SYSTEM account does not have read/write permissions for the needed registry keys. Not enough memory was available on the server.

Resolutions
Check whether the System account has read/execute permissions for the file %systemroot%\system32\drivers\ndiswan.sys. To check the permissions: Right-click the file name, and then click Properties. On the Securities tab, verify that the System account read/execute permissions for the file. If the server is low on memory, take appropriate action to increase the available memory. See Help and Support Center for information on low memory. Verify whether the following registry key exists: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters\Medias If the registry key does not exist, you can create it with the following values: Name: Medias; Type: REG_MULTI_SZ; Value: rastapi Verify whether the file rastapi.dll exists in the %systemroot%\system32 folder. Verify whether the System account has read/execute permissions for rastapi.dll. To check whether the System account has these permissions: Right-click rastapi.dll, and click Properties. On the Security tab, verify whether the System account has read/execute permissions for rastapi.dll. If it does not, add them. Verify that the following DLLs exist in the %systemroot%\System32 folder: Rasman.dll Rasmans.dll Rasapi32.dll If any of these DLLs are not present, you must repair or reinstall the operating system. For more information about repairing and reinstalling the operating system, see Help and Support Center. Verify whether the SYSTEM account has read/write permissions for the DLLs. To check the permissions: Right-click each DLL, and click Permissions. Verify whether the SYSTEM account has read/write permissions for the DLL. If it does not, add them. If the SYSTEM account has read/write permission for all three DLLs, restart the server. If the problem persists, restart the server.

Sample Event
Sample Event #1: Remote Access Connection Manager failed to start because NDISWAN could notbe opened. Sample Event #2: Remote Access Connection Manager failed to start because it could not initialize thesecurity attributes. Restart the computer. %1 Sample Event #3: Remote Access Connection Manager failed to start because it could not load one ormore communication DLLs. Ensure that your communication hardware is installed and thenrestart the computer. %1 Sample Event #4: Remote Access Connection Manager failed to start because it could not locate portinformation from media DLLs. %1 Sample Event #5: Remote Access Connection Manager failed to start because it could not registerwith the local security authority.Restart the computer. %1 Sample Event #6: Remote Access Connection Manager failed to start because the RAS RPCmodule failed to initialize. %1

Element properties:

Target

Microsoft.Windows.Server.RRAS.Microsoft_Windows_2003_Routing_and_Remote_Access_Servers_Installation

Category

EventCollection

Enabled

True

Event Source

Rasman

Alert Generate

True

Alert Severity

Error

Alert Priority

Low

Remotable

True

Alert Message

Rasman service init error

$Data/EventDescription$

Event Log

System

Comment

Mom2005ID='{AEDB8565-B212-492D-AEF9-61F0AB85920C}';MOM2005ComputerGroupID={2C66DD87-4D20-48F6-B6A3-19A1598ED025}

Member Modules:

ID	Module Type	TypeId	RunAs
_907D4578_146C_11D3_AB21_00A0C98620CE_	DataSource	Microsoft.Windows.EventProvider	Default
CollectEventData	WriteAction	Microsoft.SystemCenter.CollectEvent	Default
CollectEventDataWarehouse	WriteAction	Microsoft.SystemCenter.DataWarehouse.PublishEventData	Default
GenerateAlert	WriteAction	System.Mom.BackwardCompatibility.AlertResponse	Default

Source Code:

<Rule ID="Rasman_service_init_error_1_Rule" Target="Microsoft.Windows.Server.RRAS.Microsoft_Windows_2003_Routing_and_Remote_Access_Servers_Installation" Enabled="true" ConfirmDelivery="true" Comment="Mom2005ID='{AEDB8565-B212-492D-AEF9-61F0AB85920C}';MOM2005ComputerGroupID={2C66DD87-4D20-48F6-B6A3-19A1598ED025}">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="_907D4578_146C_11D3_AB21_00A0C98620CE_" Comment="{907D4578-146C-11D3-AB21-00A0C98620CE}" TypeID="WindowsLibrary!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="WindowsLibrary!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>System</LogName>

      <Expression>

        <And>

          <Expression>

            <RegExExpression>

              <ValueExpression>

                <XPathQuery Type="Integer">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>MatchesMOM2005BooleanRegularExpression</Operator>

              <Pattern>^(20027|20028|20030|20031|20033|20132)$</Pattern>

            </RegExExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value>Rasman</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="GenerateAlert" TypeID="MomBackwardCompatibility!System.Mom.BackwardCompatibility.AlertResponse">

      <AlertGeneration>

        <GenerateAlert>true</GenerateAlert>

        <Owner/>

        <Description>

            $Data/EventDescription$

          </Description>

        <AlertLevel>70</AlertLevel>

        <ResolutionState/>

        <Source>

            $Data/PublisherName$

          </Source>

        <Name>Rasman service init error</Name>

        <CustomFields>

          <CustomField>

            $Data/Params/Param[1]$

          </CustomField>

          <CustomField>

            $Data/Params/Param[2]$

          </CustomField>

          <CustomField/>

          <CustomField/>

          <CustomField/>

        </CustomFields>

      </AlertGeneration>

      <InvokerType>0</InvokerType>

    </WriteAction>

    <WriteAction ID="CollectEventData" TypeID="SystemCenterLibrary!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="CollectEventDataWarehouse" TypeID="DataWarehouseLibrary!Microsoft.SystemCenter.DataWarehouse.PublishEventData"/>

  </WriteActions>

</Rule>